@echo off
setlocal enabledelayedexpansion
title RestoreDefaultSettings - System Default Settings Restoration
chcp 65001 > nul

rem =================================================================
rem Auto-elevate to Administrator if not already running as admin
rem =================================================================
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [INFO] Requesting administrator privileges...
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

rem =================================================================
rem Fix user environment variables (TEMP/TMP)
rem =================================================================
echo [INFO] Checking and fixing user environment variables...

rem Get user temp directory path
if defined USERPROFILE (
    set "user_temp_path=%USERPROFILE%\AppData\Local\Temp"
) else (
    set "user_temp_path=%LOCALAPPDATA%\Temp"
)

rem Check if TEMP environment variable exists or is incorrect
if not defined TEMP (
    echo [WARNING] TEMP environment variable not found, setting to user temp directory...
    setx TEMP "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] TEMP environment variable set to !user_temp_path!
        set "TEMP=!user_temp_path!"
    ) else (
        echo [ERROR] Failed to set TEMP environment variable
    )
) else (
    echo [INFO] TEMP environment variable: %TEMP%
)

rem Check if TMP environment variable exists or is incorrect
if not defined TMP (
    echo [WARNING] TMP environment variable not found, setting to user temp directory...
    setx TMP "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] TMP environment variable set to !user_temp_path!
        set "TMP=!user_temp_path!"
    ) else (
        echo [ERROR] Failed to set TMP environment variable
    )
) else (
    echo [INFO] TMP environment variable: %TMP%
)

rem Ensure the user temp directory exists
if not exist "!user_temp_path!" (
    echo [INFO] Creating user temp directory: !user_temp_path!
    mkdir "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] User temp directory created
    ) else (
        echo [ERROR] Failed to create user temp directory
    )
)

echo ================================================================
echo                System Default Settings Restoration Tool
echo ================================================================
echo.
echo This script will restore the following settings to default state:
echo - Restore power management settings (sleep, hibernation)
echo - Enable User Account Control (UAC)
echo - Remove Windows Defender exclusion directories
echo - Enable Kernel Isolation (Core Isolation)
echo.
echo WARNING: This operation will undo previous security setting modifications
echo.
set /p confirm="Do you want to continue? (Y/N): "
if /i not "%confirm%"=="Y" (
    echo [INFO] Operation cancelled
    pause
    exit /b
)

rem =================================================================
rem Restore power management settings (sleep and hibernation)
rem =================================================================
echo.
echo [INFO] Restoring power management settings...

rem Restore default power settings (15 minutes for AC, 15 minutes for battery)
powercfg /change standby-timeout-ac 15 >nul 2>&1
powercfg /change standby-timeout-dc 15 >nul 2>&1
powercfg /change monitor-timeout-ac 15 >nul 2>&1
powercfg /change monitor-timeout-dc 15 >nul 2>&1
powercfg /change hibernate-timeout-ac 30 >nul 2>&1
powercfg /change hibernate-timeout-dc 30 >nul 2>&1

rem Enable hibernation
powercfg /hibernate on >nul 2>&1

rem Restore automatic sleep through registry (remove custom settings)
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\7bc4a2f9-d8fc-4469-b07b-33eb785aaca0" /v "Attributes" /f >nul 2>&1
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\9d7815a6-7ee4-497e-8888-515a05f02364" /v "Attributes" /f >nul 2>&1

rem Restore screen saver and lock screen settings
reg add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d "1" /f >nul 2>&1
reg delete "HKCU\Control Panel\Desktop" /v "ScreenSaverIsSecure" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "NoLockScreen" /f >nul 2>&1

rem Restore automatic lock after inactivity (remove custom setting)
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "InactivityTimeoutSecs" /f >nul 2>&1

rem Enable USB selective suspend
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\USB" /v "DisableSelectiveSuspend" /f >nul 2>&1

echo [SUCCESS] Power management settings restored to default state

rem =================================================================
rem Enable User Account Control (UAC) - Restore Default Settings
rem =================================================================
echo [INFO] Enabling User Account Control (UAC)...

rem Enable UAC (default setting)
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f >nul 2>&1

rem Restore default UAC prompt behavior for administrators (prompt for consent)
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f >nul 2>&1

rem Restore default UAC prompt behavior for standard users (prompt for credentials)
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 3 /f >nul 2>&1

rem Enable UAC elevation prompts for UIAccess applications
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableUIADesktopToggle /t REG_DWORD /d 1 /f >nul 2>&1

rem Enable secure desktop for UAC prompts
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f >nul 2>&1

rem Enable UAC for built-in Administrator account
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v FilterAdministratorToken /t REG_DWORD /d 1 /f >nul 2>&1

rem Enable UAC virtualization
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableVirtualization /t REG_DWORD /d 1 /f >nul 2>&1

rem Enable UAC for installer detection
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableInstallerDetection /t REG_DWORD /d 1 /f >nul 2>&1

echo [SUCCESS] UAC enabled and restored to default settings
echo [INFO] System restart required for UAC changes to take effect

rem =================================================================
rem Remove Windows Defender exclusion directories
rem =================================================================
echo [INFO] Removing Windows Defender exclusion directories...

rem Check if Windows Defender is available and remove all exclusions in one PowerShell call
powershell -ExecutionPolicy Bypass -Command "& { try { Get-Command Remove-MpPreference -ErrorAction Stop | Out-Null; $dirs = @(); if (Test-Path 'C:\Windows') { $dirs += 'C:\Windows' }; if (Test-Path 'C:\Users') { $dirs += 'C:\Users' }; if (Test-Path 'C:\ProgramData') { $dirs += 'C:\ProgramData' }; Get-WmiObject -Class Win32_LogicalDisk | Where-Object { $_.DriveType -eq 3 -and $_.DeviceID -ne 'C:' } | ForEach-Object { if (Test-Path ($_.DeviceID + '\')) { $dirs += ($_.DeviceID + '\') } }; if ($dirs.Count -gt 0) { foreach ($dir in $dirs) { try { Remove-MpPreference -ExclusionPath $dir -ErrorAction Stop; Write-Host '[SUCCESS] Removed exclusion: ' $dir } catch { Write-Host '[INFO] Exclusion may not exist or already removed: ' $dir } } } else { Write-Host '[INFO] No directories found to remove from exclusions' } } catch { Write-Host '[WARNING] Windows Defender PowerShell module not available - skipping exclusion removal' } }" 2>nul

echo [SUCCESS] Windows Defender exclusion directories cleaned

rem =================================================================
rem Enable Kernel Isolation (Core Isolation)
rem =================================================================
echo [INFO] Enabling Kernel Isolation (Core Isolation)...

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 1 /f >nul 2>&1

echo [SUCCESS] Kernel isolation enabled
echo [INFO] System restart required for kernel isolation changes to take effect

echo.
echo ================================================================
echo                        Operation Complete!
echo ================================================================
echo.
echo [SUCCESS] All default settings have been restored!
echo.
echo Important reminders:
echo - System power management restored to normal (sleep/hibernate after 15 minutes)
echo - UAC User Account Control re-enabled
echo - Windows Defender protection restored to normal
echo - Kernel isolation security features enabled
echo.
echo [WARNING] It is recommended to restart the computer immediately for all changes to take effect
echo.
set /p restart="Do you want to restart the computer now? (Y/N): "
if /i "%restart%"=="Y" (
    echo [INFO] System will restart in 5 seconds...
    shutdown /r /t 5 /c "Default settings restoration complete, system restarting..."
) else (
    echo [INFO] Please remember to manually restart the system later
    pause
)